o
    Žõ±jï!  ã                   @   sr   d dl mZ d dlmZmZ d dlmZ d dlmZm	Z	 d dl
mZ d dl
mZ G dd„ dƒZG d	d
„ d
eƒZdS )é    )ÚList)ÚKerberosTicketÚKerberosTicketType)ÚPackageDecryptor)ÚPLIST_ENTRYÚPRTL_AVL_TABLE)ÚWindowsMinBuild)Úhexdumpc                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚKerberosCredentialc                 C   sL   d| _ d | _d | _d| _d | _d | _g | _d | _d | _d | _	d | _
d | _d S )NÚkerberosó    )ÚcredtypeÚusernameÚpasswordÚpassword_rawÚ
domainnameÚluidÚticketsÚpinÚpin_rawÚcardinfoÚ
aes_key128Ú
aes_key256)Úself© r   ú¥/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/alsadecryptor/packages/kerberos/decryptor.pyÚ__init__   s   
zKerberosCredential.__init__c                 C   sð   d}|d| j  7 }|d| j 7 }| jd ur%|d| j 7 }|d| j ¡  7 }| jd ur1|d| j 7 }| jd ur^|d7 }|d| jd	  7 }|d
| jd  7 }|d| jd  7 }|d| jd  7 }| jrj|d| j ¡  7 }| jrv|d| j ¡  7 }|S )Nz	== Kerberos ==
z		Username: %s
z		Domain: %s
z		Password: %s
z		password (hex)%s
z
		PIN: %s
z		CARDINFO: 
z			CardName: %s
ÚCardNamez			ReaderName: %s
Ú
ReaderNamez			ContainerName: %s
ÚContainerNamez			CSPName: %s
ÚCSPNamez		AES128 Key: %s
z		AES256 Key: %s
)	r   r   r   r   Úhexr   r   r   r   )r   Útr   r   r   Ú__str__   s&   


zKerberosCredential.__str__c                 C   sª   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d< | j|d	< g |d
< | j	D ]}| 
¡ |d
< q6| jrI| j ¡ |d< | jrS| j ¡ |d< |S )Nr   r   r   r   r   r   r   r   r   r   Úaes128Úaes256)r   r   r   r   r   r   r   r   r   r   Úto_dictr   r!   r   )r   r"   Úticketr   r   r   r&   7   s$   









zKerberosCredential.to_dictN)Ú__name__Ú
__module__Ú__qualname__r   r#   r&   r   r   r   r   r
      s    r
   c                       sF   e Zd Zd‡ fdd„	Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z‡  Z	S )ÚKerberosDecryptorTc                    s4   t ƒ  d|||¡ || _|| _g | _d | _d | _d S )NÚKerberos)Úsuperr   Údecryptor_templateÚwith_ticketsÚcredentialsÚcurrent_ticket_typeÚcurrent_cred)r   Úreaderr.   Úlsa_decryptorÚsysinfor/   ©Ú	__class__r   r   r   M   s   
zKerberosDecryptor.__init__c                 Ã   sL   �|   d| jj¡I d H }| j || jj ¡I d H }| j |¡I d H }||fS )Nzkerberos.dll)Úfind_signaturer.   Ú	signaturer3   Úget_ptr_with_offsetÚfirst_entry_offsetÚget_ptr)r   ÚpositionÚptr_entry_locÚ	ptr_entryr   r   r   Úfind_first_entryV   s
   €z"KerberosDecryptor.find_first_entryc              
   Ã   sR   �zt  || j| jj| j¡I d H }| jj |¡ W d S  t	y( } z|‚d }~ww ©N)
r   Úaparser3   r.   r5   r1   r2   r   ÚappendÚ	Exception)r   Úkerberos_ticketÚktÚer   r   r   Úhandle_ticket\   s   €€ÿzKerberosDecryptor.handle_ticketc           
   
   Ã   s  �z|   ¡ I d H \}}W n ty& } z|  d| ¡ W Y d }~d S d }~ww | jjtjjk r1d S g }| j 	|¡I d H  t | j¡I d H }| | j¡I d H }|  |jj|¡I d H  |D ]*}|  || jjj¡I d H  | j 	|¡I d H  | jj | j¡I d H }	|  |	¡I d H  q[d S )Nz"Failed to find structs! Reason: %s)r@   rD   Úlogr5   Úbuildnumberr   Ú	WIN_VISTAÚvaluer3   Úmover   ÚloadÚ	walk_listÚprocess_session_elistr   ÚreadÚwalk_avlÚBalancedRootÚ
RightChildÚlog_ptrr.   Úkerberos_session_structr(   Úprocess_session)
r   Úentry_ptr_valueÚentry_ptr_locrG   Ú	entry_ptrÚresult_ptr_listÚ	avl_tableÚ
start_nodeÚptrÚkerberos_logon_sessionr   r   r   Ústartc   s*   €€þüzKerberosDecryptor.startc                 Ã   s   �d S rA   )r3   rM   ÚlocationÚ	read_uintr.   rV   rN   rW   )r   Úelistr_   r   r   r   rP   }   s   €z'KerberosDecryptor.process_session_elistc                 Ã   s€  �t ƒ | _|j| j_|jj | j¡I d H | j_|jj	 | j¡I d H | j_
|jjdkr›|jj| j| jjd�I d H }| | j| jj¡I d H  |jD ]S}|jjdkrš|jjdkru|jj | j|jj¡I d H }|rt| j|dd�\}}|rt|| j_qG|jjdkrš|jj | j|jj¡I d H }|rš| j|dd�\}}|rš|| j_qG|jjjdkrÝ|jj | j¡I d H }| jj d¡du rÒ| j|dd�\| j_| j_| jjd urÑ| jj ¡ | j_n|  |¡\| j_| j_|j jdk�r|j j| j| jj!d�I d H }|j" | j¡I d H }	|  |	¡\| j_#}
|j$dk�r|j% &¡ | j_'| j(du �r·|j)j*jdk�rL|j)j*j|j)j*j+k�rL|j)j*j|j)j*j+d k�rLt,j-| _.| j/|j)j*| j0| jj1d	�I d H  |j2j*jdk�r€|j2j*j|j2j*j+k�r€|j2j*j|j2j*j+d k�r€t,j3| _.| j/|j2j*| j0| jj1d	�I d H  |j4j*jdk�r´|j4j*j|j4j*j+k�r´|j4j*j|j4j*j+d k�r´t,j5| _.| j/|j4j*| j0| jj1d	�I d H  d | _.| j 6| j¡ d S )
Nr   )Úoverride_finaltypeé   T)Úbytes_expectedé    ú$é   )Úoverride_ptr)7r
   r2   ÚLocallyUniqueIdentifierr   r0   ÚUserNameÚread_stringr3   r   ÚDomainer   ÚpKeyListrL   rQ   r.   Úkeys_list_structÚhash_password_structÚ
KeyEntriesÚgenericÚSizeÚ	ChecksumpÚread_rawÚdecrypt_passwordr   r   ÚPasswordÚLengthÚread_maxdataÚendswithr   r   r!   ÚSmartcardInfosÚcsp_info_structÚPinCoder   ÚCspDataLengthÚCspDataÚ	get_infosr   r/   Ú	Tickets_1ÚFlinkra   r   ÚTGSr1   rO   rH   Úkerberos_ticket_structÚ	Tickets_2ÚCLIENTÚ	Tickets_3ÚTGTrC   )r   r_   Úkey_listÚkeyÚkeydataÚdec_keyÚ_ÚpwdataÚcsp_infoÚpin_encÚraw_decr   r   r   rW   †   sp   €

€€€   z!KerberosDecryptor.process_session)T)
r(   r)   r*   r   r@   rH   r`   rP   rW   Ú__classcell__r   r   r6   r   r+   L   s    		r+   N)Útypingr   Úpypykatz.commons.kerberosticketr   r   Ú&pypykatz.alsadecryptor.package_commonsr   Ú$pypykatz.alsadecryptor.win_datatypesr   r   Úpypykatz.commons.commonr   r	   r
   r+   r   r   r   r   Ú<module>   s   ?